CVE-2022-50746: erofs: validate the extent length for uncompressed pclusters
In the Linux kernel, the following vulnerability has been resolved:
erofs: validate the extent length for uncompressed pclusters
syzkaller reported a KASAN use-after-free: https://syzkaller.appspot.com/bug?extid=2ae90e873e97f1faf6f2
The referenced fuzzed image actually has two issues: - mpa == 0 as a non-inlined pcluster; - The logical length is longer than its physical length.
The first issue has already been addressed. This patch addresses the second issue by checking the extent length validity.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch erofs: validate the extent length for uncompressed pclusters
Event History
Frequently Asked Questions
What malformed filesystem condition is required to trigger this issue?
The affected image contains an uncompressed, non-inlined pcluster whose logical extent length is greater than its physical length. The report also identified an m_pa == 0 condition, but that separate issue had already been addressed.
What should be done if the kernel is affected?
Apply the extent-length validation fix referenced in the listed stable kernel commits. The fix rejects invalid extent lengths for uncompressed pclusters.